Thanks for clarifying things a little. I know about “ip rule” in Linux, and I am trying to figure out what is happening in RouterOS 7.22 (and before) when I use “/routing rule”. And what those mange and vrf rules are doing.
Now recently I saw someone posting “ip rule” output from what apparently was a RouterOS router, which of course clarifies things, but I am confused about how they got that shell access.
Or is it possible to run a shell in a container and see that info?
Yes, that post is the output of running ip rule in a container, and it displays the policies of that container, and I can confirm the change that that user observed.
Since 7.22:
In 7.21:
The default priorities in 7.21 look more correct, because you can then insert your rules (in the container and apply to that container) between local and main because there are plenty of available numbers to choose from.
Example:
The default priorities in 7.22 mean you cannot insert anything between local and main or in front of them anymore. But this issue appears to only concern containers, not the routing rules of RouterOS.
But are the routing rules you see in the container the ones that RouterOS created based on /routing/rule ?
Or is this something else? When I type “ip rule” in a Linux machine that does not have rules I get:
# ip rule
0: from all lookup local
32766: from all lookup main
32767: from all lookup default
Apparently they wanted something before “local” and changed the priorities, but the result, and where “chain” fits in, is unclear to me. ip rule does not seem to support the notion of multiple chains, like iptables does.
It's independent from the routing rules in RouterOS. Here is an example in 7.21:
RouterOS has no routing rules defined, but the container has, and the rules affect only the container.
But in 7.22 the pre-populated rules now have the unfortunate 1, 2, 3 priorities, and this is probably a bug, which gives problem to containers that want to insert custom rules between them.
For example, normally they only need to pick a priority in the thousands for the rules, and on both the example of your Linux machine, as well as containers under <= 7.21, the rule will be inserted between lookup local and lookup main as expected.
In 7.22 those rules will be placed at the end and will be ineffective. As an example from another user:
